2023-04-24 12:24:31 +02:00
{
"id" : "CVE-2021-35516" ,
"sourceIdentifier" : "security@apache.org" ,
"published" : "2021-07-13T08:15:07.137" ,
2023-11-07 21:03:21 +00:00
"lastModified" : "2023-11-07T03:36:33.553" ,
"vulnStatus" : "Modified" ,
2023-04-24 12:24:31 +02:00
"descriptions" : [
{
"lang" : "en" ,
"value" : "When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package."
} ,
{
"lang" : "es" ,
"value" : "Al leer un archivo 7Z especialmente dise\u00f1ado, Compress puede asignar grandes cantidades de memoria que finalmente conllevan a un error de falta de memoria incluso para entradas muy peque\u00f1as. Esto podr\u00eda ser usado para montar un ataque de denegaci\u00f3n de servicio contra los servicios que usan el paquete sevenz de Compress"
}
] ,
"metrics" : {
"cvssMetricV31" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"cvssData" : {
"version" : "3.1" ,
"vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" ,
"attackVector" : "NETWORK" ,
"attackComplexity" : "LOW" ,
"privilegesRequired" : "NONE" ,
"userInteraction" : "NONE" ,
"scope" : "UNCHANGED" ,
"confidentialityImpact" : "NONE" ,
"integrityImpact" : "NONE" ,
"availabilityImpact" : "HIGH" ,
"baseScore" : 7.5 ,
"baseSeverity" : "HIGH"
} ,
"exploitabilityScore" : 3.9 ,
"impactScore" : 3.6
}
] ,
"cvssMetricV2" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"cvssData" : {
"version" : "2.0" ,
"vectorString" : "AV:N/AC:L/Au:N/C:N/I:N/A:P" ,
"accessVector" : "NETWORK" ,
"accessComplexity" : "LOW" ,
"authentication" : "NONE" ,
"confidentialityImpact" : "NONE" ,
"integrityImpact" : "NONE" ,
"availabilityImpact" : "PARTIAL" ,
"baseScore" : 5.0
} ,
"baseSeverity" : "MEDIUM" ,
"exploitabilityScore" : 10.0 ,
"impactScore" : 2.9 ,
"acInsufInfo" : false ,
"obtainAllPrivilege" : false ,
"obtainUserPrivilege" : false ,
"obtainOtherPrivilege" : false ,
"userInteractionRequired" : false
}
]
} ,
"weaknesses" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"description" : [
{
"lang" : "en" ,
"value" : "CWE-770"
}
]
} ,
{
2023-11-07 21:03:21 +00:00
"source" : "f0158376-9dc2-43b6-827c-5f631a4d8d09" ,
2023-04-24 12:24:31 +02:00
"type" : "Secondary" ,
"description" : [
{
"lang" : "en" ,
"value" : "CWE-130"
}
]
}
] ,
"configurations" : [
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:apache:commons_compress:*:*:*:*:*:*:*:*" ,
"versionStartIncluding" : "1.6" ,
"versionEndIncluding" : "1.20" ,
"matchCriteriaId" : "84FE713B-2D0A-473D-8CFA-6A45D7873C2D"
}
]
}
]
} ,
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*" ,
"matchCriteriaId" : "F3E0B672-3E06-4422-B2A4-0BD073AEC2A1"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*" ,
"matchCriteriaId" : "3A756737-1CC4-42C2-A4DF-E1C893B4E2D5"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*" ,
"matchCriteriaId" : "B55E8D50-99B4-47EC-86F9-699B67D473CE"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "F1BE6C1F-2565-4E97-92AA-16563E5660A5"
}
]
}
]
} ,
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:oracle:banking_digital_experience:*:*:*:*:*:*:*:*" ,
"versionStartIncluding" : "18.1" ,
"versionEndIncluding" : "18.3" ,
"matchCriteriaId" : "366A6277-5D74-44C8-94A9-8ADB5568B5FB"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:oracle:banking_digital_experience:19.1:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "F7BDFC10-45A0-46D8-AB92-4A5E2C1C76ED"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:oracle:banking_digital_experience:19.2:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "18127694-109C-4E7E-AE79-0BA351849291"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:oracle:banking_digital_experience:20.1:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "33F68878-BC19-4DB8-8A72-BD9FE3D0ACEC"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:oracle:banking_digital_experience:21.1:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "0D6895A6-511A-4DC6-9F9B-58E05B86BDB1"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:oracle:banking_enterprise_default_management:2.7.0:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "E0FCD3BC-33D8-49D1-844B-6B9DE0CA4997"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:oracle:banking_party_management:2.7.0:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "C542DC5E-6657-4178-9C69-46FD3C187D56"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "E869C417-C0E6-4FC3-B406-45598A1D1906"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:oracle:business_process_management_suite:12.2.1.4.0:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "DFEFE2C0-7B98-44F9-B3AD-D6EC607E90DA"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "2A3622F5-5976-4BBC-A147-FC8A6431EA79"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.4:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "B465F237-0271-4389-8035-89C07A52350D"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.8.0:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "98FB24DB-AF91-48D0-9CA5-C8250D183FD5"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.14.0:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "0AB059F2-FEC4-4180-8A90-39965495055E"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.14.0:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "5A276784-877B-4A29-A8F1-70518A438A9A"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:oracle:communications_diameter_intelligence_hub:*:*:*:*:*:*:*:*" ,
"versionStartIncluding" : "8.0.0" ,
"versionEndIncluding" : "8.2.3" ,
"matchCriteriaId" : "B5AAD5EB-403D-4DCD-96F6-3871889B9403"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:*" ,
"versionStartIncluding" : "8.0.0" ,
"versionEndIncluding" : "8.2.5" ,
"matchCriteriaId" : "1141CDB6-25F6-406C-9F4C-9D84993ED273"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "55F091C7-0869-4FD6-AC73-DA697D990304"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "4D134C60-F9E2-46C2-8466-DB90AD98439E"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.7.2.0:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "18E7AC20-F70C-4A92-817D-94CE9FB3EB0D"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.8.1.0:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "86281B71-36EB-490F-A12A-B88C1F374BE4"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:oracle:flexcube_universal_banking:*:*:*:*:*:*:*:*" ,
"versionStartIncluding" : "14.0.0" ,
"versionEndIncluding" : "14.3.0" ,
"matchCriteriaId" : "54BE0CCE-8216-4CCF-96E1-38EF76124368"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:oracle:flexcube_universal_banking:12.4.0:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "F3D55FB5-8ED8-4797-B5BC-545477AF7347"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:oracle:flexcube_universal_banking:14.5:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "609645BF-B34F-40AC-B9C9-C3FB870F4ED2"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:oracle:healthcare_data_repository:8.1.0:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "66C673C4-A825-46C0-816B-103E1C058D03"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:oracle:insurance_policy_administration:11.0.2:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "0F89EC4B-6D34-40F0-B7C6-C03D03F81C13"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:oracle:insurance_policy_administration:11.1.0:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "00C9E689-ED91-4A9D-B9C0-5BF4EC131409"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:oracle:insurance_policy_administration:11.2.8:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "FC2370B5-F41B-45F6-AC9F-9C7B258AA717"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:oracle:insurance_policy_administration:11.3.0:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "EF958C28-4289-4433-8CD9-B6551F01926F"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:oracle:insurance_policy_administration:11.3.1:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "57E9FC66-F6A0-4FB0-8D92-2C9B9E3F2184"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "7E1E416B-920B-49A0-9523-382898C2979D"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "D9DB4A14-2EF5-4B54-95D2-75E6CF9AA0A9"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "C8AF00C6-B97F-414D-A8DF-057E6BFD8597"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*" ,
"versionStartIncluding" : "17.7" ,
"versionEndIncluding" : "17.12" ,
"matchCriteriaId" : "08FA59A8-6A62-4B33-8952-D6E658F8DAC9"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "202AD518-2E9B-4062-B063-9858AE1F9CE2"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "10864586-270E-4ACF-BDCC-ECFCD299305F"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "38340E3C-C452-4370-86D4-355B6B4E0A06"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.1.1:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "A3ED272C-A545-4F8C-86C0-2736B3F2DCAF"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.2.2:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "C5B4C338-11E1-4235-9D5A-960B2711AC39"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.3.1:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "8C93F84E-9680-44EF-8656-D27440B51698"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "D6A4F71A-4269-40FC-8F61-1D1301F2B728"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "5A502118-5B2B-47AE-82EC-1999BD841103"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "7569C0BD-16C1-441E-BAEB-840C94BE73EF"
}
]
}
]
}
] ,
"references" : [
{
"url" : "http://www.openwall.com/lists/oss-security/2021/07/13/2" ,
"source" : "security@apache.org" ,
"tags" : [
"Mailing List" ,
"Third Party Advisory"
]
} ,
{
"url" : "https://commons.apache.org/proper/commons-compress/security-reports.html" ,
"source" : "security@apache.org" ,
"tags" : [
"Vendor Advisory"
]
} ,
{
2023-11-07 21:03:21 +00:00
"url" : "https://lists.apache.org/thread.html/r67ef3c07fe3b8c1b02d48012149d280ad6da8e4cec253b527520fb2b%40%3Cdev.poi.apache.org%3E" ,
"source" : "security@apache.org"
2023-04-24 12:24:31 +02:00
} ,
{
2023-11-07 21:03:21 +00:00
"url" : "https://lists.apache.org/thread.html/r9f54c0caa462267e0cc68b49f141e91432b36b23348d18c65bd0d040%40%3Cnotifications.skywalking.apache.org%3E" ,
"source" : "security@apache.org"
2023-04-24 12:24:31 +02:00
} ,
{
2023-11-07 21:03:21 +00:00
"url" : "https://lists.apache.org/thread.html/racd0c0381c8404f298b226cd9db2eaae965b14c9c568224aa3f437ae%40%3Cnotifications.skywalking.apache.org%3E" ,
"source" : "security@apache.org"
2023-04-24 12:24:31 +02:00
} ,
{
2023-11-07 21:03:21 +00:00
"url" : "https://lists.apache.org/thread.html/rb064d705fdfa44b5dae4c366b369ef6597951083196321773b983e71%40%3Ccommits.pulsar.apache.org%3E" ,
"source" : "security@apache.org"
2023-04-24 12:24:31 +02:00
} ,
{
2023-11-07 21:03:21 +00:00
"url" : "https://lists.apache.org/thread.html/rb6e1fa80d34e5ada45f72655d84bfd90db0ca44ef19236a49198c88c%40%3Cnotifications.skywalking.apache.org%3E" ,
"source" : "security@apache.org"
2023-04-24 12:24:31 +02:00
} ,
{
2023-11-07 21:03:21 +00:00
"url" : "https://lists.apache.org/thread.html/rb7adf3e55359819e77230b4586521e5c6874ce5ed93384bdc14d6aee%40%3Cnotifications.skywalking.apache.org%3E" ,
"source" : "security@apache.org"
2023-04-24 12:24:31 +02:00
} ,
{
2023-11-07 21:03:21 +00:00
"url" : "https://lists.apache.org/thread.html/rba65ed5ddb0586f5b12598f55ec7db3633e7b7fede60466367fbf86a%40%3Cnotifications.skywalking.apache.org%3E" ,
"source" : "security@apache.org"
2023-04-24 12:24:31 +02:00
} ,
{
2023-11-07 21:03:21 +00:00
"url" : "https://lists.apache.org/thread.html/rd4332baaf6debd03d60deb7ec93bee49e5fdbe958cb6800dff7fb00e%40%3Cnotifications.skywalking.apache.org%3E" ,
"source" : "security@apache.org"
2023-04-24 12:24:31 +02:00
} ,
{
2023-11-07 21:03:21 +00:00
"url" : "https://lists.apache.org/thread.html/rf5b1016fb15b7118b9a5e16bb0b78cb4f1dfcf7821eb137ab5757c91%40%3Cannounce.apache.org%3E" ,
"source" : "security@apache.org"
2023-04-24 12:24:31 +02:00
} ,
{
"url" : "https://lists.apache.org/thread.html/rf68442d67eb166f4b6cf0bbbe6c7f99098c12954f37332073c9822ca%40%3Cuser.commons.apache.org%3E" ,
"source" : "security@apache.org" ,
"tags" : [
"Mailing List" ,
"Vendor Advisory"
]
} ,
{
2023-11-07 21:03:21 +00:00
"url" : "https://lists.apache.org/thread.html/rfba19167efc785ad3561e7ef29f340d65ac8f0d897aed00e0731e742%40%3Cnotifications.skywalking.apache.org%3E" ,
"source" : "security@apache.org"
2023-04-24 12:24:31 +02:00
} ,
{
"url" : "https://security.netapp.com/advisory/ntap-20211022-0001/" ,
"source" : "security@apache.org" ,
"tags" : [
"Third Party Advisory"
]
} ,
{
"url" : "https://www.oracle.com/security-alerts/cpuapr2022.html" ,
"source" : "security@apache.org" ,
"tags" : [
"Patch" ,
"Third Party Advisory"
]
} ,
{
"url" : "https://www.oracle.com/security-alerts/cpujan2022.html" ,
"source" : "security@apache.org" ,
"tags" : [
"Patch" ,
"Third Party Advisory"
]
} ,
{
"url" : "https://www.oracle.com/security-alerts/cpujul2022.html" ,
"source" : "security@apache.org" ,
"tags" : [
"Patch" ,
"Third Party Advisory"
]
} ,
{
"url" : "https://www.oracle.com/security-alerts/cpuoct2021.html" ,
"source" : "security@apache.org" ,
"tags" : [
"Patch" ,
"Third Party Advisory"
]
}
]
}
